Transforming Access to Student Outcomes in Higher Education (“TASO”) and the Higher Education Access Tracker (“HEAT”) have worked together to create the Higher Education Evaluation Library (“we”, “us”, “our”, “HEEL”). HEEL is funded by the Office for Students (OfS). Together, HEAT and TASO are the joint controllers for personal data used as part of the HEEL.
This privacy notice is to inform you of how we use your personal data in all the ways you may interact with HEEL.
We have identified the following ways you might interact with us and how we define you.
- Researcher(s) – individual(s) who conducted, authored or are cited within the research that has been submitted for publication on the HEEL. Their contact information may be made publicly available if it is included in the file attachments uploaded to the HEEL.
- Key Contact – this is someone who is designated as the most knowledgeable contact for the research an organisation has submitted for inclusion on the HEEL. They may have their contact information made publicly available.
- Submission Point of Contact – this is the person making the submission for research to appear in the HEEL. They could also be a Researcher or the Key Contact but may not be either. Their information will not feature on the HEEL library unless also entered elsewhere as a Key Contact or Researcher.
- Visitor – anyone looking at the HEEL website location (this is an open access website and you do not need to sign in to access the evaluation material in the library).
It is possible for someone to have multiple types of interaction with us e.g. a Researcher could also be the Research Key Contact, the person submitting the research to HEEL and are therefore the Submission Contact; they also be the point of contact for the organisation making the submission and find HEEL useful for themselves as a Visitor.
To be able to make a submission for the HEEL you need to register with HEAT. If you are already a HEAT Member (see the HEAT Privacy Notice) you already have the ability to access the HEEL Submission Service. If you are not a HEAT Member, you need to register with HEAT to have the ability to use the HEEL Submission Service – this does not automatically mean you are a HEAT Member.
For any questions or concerns regarding this privacy notice, you can contact us at data@taso.org.uk.
What is personal data?
Personal data is any information that can be used to identify you. We may create unique codes for you in our systems, so we reduce how easily you are identified. These codes are also considered to be personal data. We do our best to reduce anyone’s ability to know who you are unless they need to as part of the work we are doing.
What personal data we collect
To make a submission to have an evaluation included in the HEEL we collect your name, email address, telephone number and job title and the information about the evaluation you are submitting including any associate information or personal data. We may also understand who your employer is, your project history and the research or organisation you are associated with.
More occasionally we may gather your opinion and any other information that can be used to identify you in the communications we have with you.
If you are not a HEAT member but have registered with HEAT to have the ability to make a submission to the HEEL, we will know whether you are a HEAT member or not and will register whether you have indicated if you don’t want to receive the HEAT bulletin email.
As a Visitor to the HEEL website, we will collect:
- Information about the device used to access our website, your visits and use of the website including your IP address, internet log information, location, browser type and version, referrer and activity, and details of visitor behaviour patterns
- Your activity and preferences when visiting our website including through the use of cookies (see “Cookies”, below)
- IP address, operating system and browser information
- The information you provide in any of the forms you complete on the website
How we use your personal data
We will only use your personal data in a way that you expect us to use it. We will never sell your data or share it with anyone that you do not expect it to be shared with. We have aligned our uses to the lawful basis for your awareness as we’re required to do by UK law.
| Uses | Lawful Basis |
| To run and manage the Higher Education Evaluation Library. | The lawful basis we shall be relying on is for the performance of a task carried out in the public interest by a data controller in accordance with UK GDPR Article 6.1(e), also known as “Public Task”. |
| To register your organisation with HEAT so it’s able to use the HEEL submission process. | |
| To make a submission for research to be published in the HEEL. | |
| To review submissions to the HEEL, ask for further information and communicate the outcome to you. | |
| To allow people using the HEEL to contact the most appropriate person (the Key Contact only) about the research. | |
| If your personal data is made publicly available on HEEL, we may use it to refer you to organisations or institutions that have an interest in the area of research relevant to your research submission in the HEEL. | The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f). |
| To review and analyse the research submission process and the HEEL more generally. This may mean we contact you to understand your opinion of HEEL so we can make improvements or ask you to help us with the best practices for management of HEEL. | |
| To occasionally spotlight an evaluation on the TASO website and create aggregated statistics about the HEEL evaluation submissions. | |
| To make contact with you to encourage you to make submissions to the HEEL or to remind you to complete any open submission that has been started.Only HEAT will have access to the partially completed submission data and will not share this with anyone. | |
| To send you reminders when your account has become inactive after 60 days of inactivity. | |
| To invite you to private and public events relevant to your HEEL submission. | The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 6.1(a). |
| To reply to any communications you have with us and share any relevant information with individuals that may be able to answer your query. | The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f). |
| Unless you select opt-out, HEAT will add you to their mailing list for their HEAT Bulletin. You are able to opt-out at any time.[NOTE: HEAT is the sole data controller for the personal data used for sending their HEAT Bulletin and your personal information will be used in accordance with the HEAT website privacy notice found here.] | |
| To identify Personal Data and take relevant action upon submission of a data subject rights request. | Processing is necessary for compliance with a legal obligation to which the controller is subject under UK GDPR Article 6.1(c). The legal obligation is the separate obligation under the UK GDPR to comply with the exercise by a data subject of their rights and the separate obligation on a controller to use personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. |
| To be able to assess any impact on individuals of a Personal Data Breach. | |
| To deal with any legal claims and any ongoing litigation cases as they might arise. | Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. |
How long we keep your data
We will only retain personal data for as long as it is necessary to fulfil the purpose for which it was collected. We distinguish between personal data contained within HEEL research submissions and personal data collected to create and manage user accounts used to administer and submit that research.
For research submissions, personal data that you have chosen to include in a HEEL research submission will be retained indefinitely or for as long as HEEL remains as an active resource. This reflects the purpose of the HEEL as a long-term research repository, enabling work to be properly attributed, accessed, and cited over time. However, you (or a member of your organisation) may amend a submission or update personal data within it at any time by logging into the HEEL Submission Portal using your/their HEAT user account.
Where a research report or any associated contact information has been downloaded or copied from the HEEL, we no longer have any jurisdiction over the personal data and can accept no liability for uses of the personal data outside of the activities outlined in this notice.
Personal data used to administer your HEAT user account (which enables you to make HEEL submissions) is retained whilst your account is active. This will include the use of your personal data to send you the HEAT Bulletin newsletter if you did not choose to opt-out of this. All user account personal data is administered in accordance with HEAT policies and their privacy notice which can be accessed here.
Your HEAT account will be deactivated after 60 days of inactivity. You will receive two email reminders to log in, 18 and 4 days before deactivation. Where your organisation is not a HEAT member, and your account has been deactivated with no login activity for two calendar years at the point of an annual review, HEAT will contact you to notify you that your user account will be removed. If you do not respond within 30 days, your account and associated personal data will be deleted.
Where your organisation is a HEAT member, responsibility for managing and deleting user accounts rests with your organisation, in accordance with the HEAT Legal Agreement, and accounts may be removed at their discretion.
If you are a Visitor to the HEEL and have signed up to receive a newsletter and communications from us, this will be managed in accordance with TASO’s retention policy for communications which can be found on the TASO privacy notice which can be accessed here. This means your data is kept until you opt-out of receiving communications from us. Unless you have accepted cookies, no further personal data is retained after you leave the website.
Where HEEL hosts any meetings or workshops, TASO will sometimes record audio and video, and may have them transcribed. All recordings and transcriptions will be deleted or anonymised after 12 months.
Who do we share your data with?
If you are a HEAT Member, your submission is solely held and managed by HEAT until you click the submission button within the HEEL Submission Service process. When you click submit it triggers an automatic secure transfer of your personal data within the submission, along with the submission, to TASO.
If you are not a HEAT Member and have registered with HEAT solely for the ability to make a submission via the HEEL Submission Service managed by HEAT, at the point of registration, you are agreeing to your personal data being shared with TASO. Similarly, when you click the submission button within the HEEL Submission Service process further personal data, along with the submission, is securely shared with TASO.
Your personal data may also be stored with specific third-party services for the minimum period necessary to perform activities with your personal data outlined above. Each third-party is subject to contractual and security reviews to ensure adequate and comparative levels of security, we’d expect for ourselves, is provided for the data they process on our behalf.
The types of third-party providers we use include:
- A digital platform that hosts the HEEL submission service process (managed by HEAT)
- A digital platform that manages the publication of the HEEL submissions so they are made accessible (managed by TASO)
- Communications providers
- Survey platform services
- Client Relationship Management services
- Website service providers
Where appropriate, we may share your personal information with our professional advisers including our lawyers and auditors, and project partners, where it is strictly necessary. It is also possible that we may be required to share your data to comply with applicable laws or with valid legal processes, such as in response to a court order.
HEEL does not transfer your personal data out of the UK or the EU but if there are any service providers we use in the future that transfers your personal data outside of these locations, we will ensure a similar degree of protection is afforded by implementing at least one of the following safeguards:
- Transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK (the UK also recognises the European Commission list of adequate countries. For further details, see European Commission: Adequacy of the protection of Personal Data in non-EU countries)
- Specific contracts/agreements approved by the UK which give personal data the same protection it has in the UK. For further details, see UK International Data Transfer Agreements. We will also assess in-country standards as part of this process.
Security
We take the security of your information very seriously and have put physical, technical, operational, and administrative strategies, controls and measures in place to help protect your personal information from unauthorised access, use or disclosure as required by law and in accordance with accepted good industry practice. We will always keep these under review to make sure that the measures we have implemented remain appropriate.
Cookies
As you interact with the HEEL website managed by TASO or the HEEL Submission Service website managed by HEAT, we automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies to enhance your experience of our website.
Our website uses cookies for collecting user information which may include IP address, operating system, and browser information. We use persistent cookies to track returning visitors. They expire after 12 months and enable us to compare website traffic from month to month.
Cookies are text files, which identify a user’s computer to our servers. Cookies in themselves do not identify the individual user, just the computer used. You can learn more about cookies by visiting http://www.allaboutcookies.org/.
You can manage and delete cookies through your web browser. Each browser manages cookies differently, but you can learn more about cookie settings in the most common browsers using the links below:
You can also prevent your data from being used by Google Analytics by using the Google Opt-out Browser Add-on, available at this link.
Your data protection rights
You have the following rights in respect of your personal data:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. Where personal data has already been downloaded or copied from HEEL or your personal data is in a research report we will not be able to delete your data.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances including where we are processing your data based on consent.
- Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
To exercise any of these rights, please contact us at data@taso.org.uk.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us by contacting data@taso.org.uk.
If you are not satisfied with how we have handled your data protection complaint, you can then lodge a complaint with the Information Commissioner’s Office. They can be contacted using the information provided at:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://ico.org.uk/concerns/.
Changes to this privacy notice
We may update this privacy notice from time to time. Any changes will be posted on this page with an updated revision date. This Privacy Notice was last updated in May 2026.
Contact us
If you have any questions about this privacy notice or how we handle your data, please contact us at data@taso.org.uk.